Nagios Support Forum

Hello,

I have ran the below command and getting critical alert.

./check_nrpe -H IP_Address -p 5666 -c CheckEventLog -a filter=new file=all MinWarn=1 MinCrit=2 filter-generated=\<30 filter+eventID=="4111" filter+eventType==all filter=all
eventlog: 0 < critical|'eventlog'=0;1;2;

Event id 4111 is not present in 30 minute. Please guide me.

Thanks,
Imran Khan.

Does using eventID 1111 return the same? Is this a valid ID?

Hello,

I am using id:- 4111and it is valid.

Thanks,
Imran Khan.

what is the full output of the command:

Hello,

Out put of command is as below only.
eventlog: 0 < critical|'eventlog'=0;1;2;

Thanks,
Imran Khan.

Try changing min to max:

Hello,

Tried but getting same output.

./check_nrpe -H IP_Address -p 5666 -c CheckEventLog -a filter=new file=all MaxWarn=1 MaxCrit=2 filter-generated=\>15d filter+eventID=="4111" filter+eventType==all filter=all
Eventlog check ok|'eventlog'=0;1;2;

./check_nrpe -H IP_Address -p 5666 -c CheckEventLog -a filter=new file=all MaxWarn=1 MaxCrit=2 filter-generated=\>60d filter+eventID=="4111" filter+eventType==all filter=all
Eventlog check ok|'eventlog'=0;1;2;

./check_nrpe -H IP_Address -p 5666 -c CheckEventLog -a filter=new file=all MaxWarn=1 MaxCrit=2 filter-generated=\>30m filter+eventID=="4111" filter+eventType==all filter=all
Eventlog check ok|'eventlog'=0;1;2;

Thanks,
Imran Khan.

imran_khan wrote:Tried but getting same output.

In what way? I though you said it was not present in the past 30 minutes. That would make the check 'ok' now instead of critical. Is that not the output you posted?

imran_khan wrote:Eventlog check ok|'eventlog'=0;1;2;

Hello,

But this id is present in last one week, 1-month and 2-month, it should display critical alert if event id is present. correct?
I have mentioned my last post >15d, >60d and >30m but it display result OK for all the commands.

Thanks,
Imran Khan.

Well, color me confused.

imran_khan wrote: Event id 4111 is not present in 30 minute. Please guide me.

imran_khan wrote:But this id is present in last one week, 1-month and 2-month, it should display critical alert if event id is present. correct?
I have mentioned my last post >15d, >60d and >30m but it display result OK for all the commands.

Which is it?

Can you please explain when you want this check to alert and what thresholds you want to set.